I created 100s of HEC tokens and put them in an app, which has been pushed down to several Heavy Forwarders. Most of them are working fine, but strangely, several of them are not working and give the following invalid token error.
They are all in the inputs.conf as the other working ones in the app. Configurations all appear Okay to me.
curl -k https://splunk-hec.abc.net:8088/services/collector -H 'Authorization: Splunk adf401c2-43ef-4689-a56c-ba47f907eca8' -d '{"sourcetype": "https:hectest", "event":"HEC Token Test", "index":"index_hectest"}'
{"text":"Invalid token","code":4}
↧
Why am I getting the following Http Event Collector (HEC) errors?: {"text":"Invalid token","code":4}
↧